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Sniffer Programming 


1. INTRODUCTION 


The R-4903 ARCNET Line Analyzer, colloquially known as the "Sniffer", is a 
combination of hardware and software which functions as a network data analyzer for 
ARCNET. The unique hardware feature, which is not possible using any standard 
ARCNET computer node, is the ability to receive any data packet which is transmitted 
on the network. That special hardware implementation has been combined with soft- 
ware that allows network traffic to be collected and interpreted in much the same way 
that a logic analyzer does for digital signals. 


The Sniffer is configured around a standard portable personal computer, which makes it 
a tool useful in the field as well as the development laboratory. 


2. KEY FEATURES 


The Sniffer: 
- is the only portable line analyzer for ARCNET communications 
- is a self contained unit for data collection, recording and analysis 
- can function as a complete standalone development station 
- includes general system behavior monitoring package 
- collects all or a subset of packets without affecting the network 


- can accept packets at the full network speed, with none lost under most 
circumstances 


- will accumulate all broadcast packets 

- timestamps packet arrivals to 1 millisecond resolution 

- can be used to debug application software problems by observing actual 
message streams without changing software or hardware in the communicat- 


ing stations 


- can be used for performance analysis of higher level protocols 


3. SPECIFICATIONS 
(Subject to change without notice) 


Hardware 

Bus: IBM PC 8 bit connector 

Network: Standard ARCNET BNC connector on rear 
Warranty: One year 

Software 


1. Sniffer Software 


A complete collection and analysis shell is provided. Source code is supplied, so that it 
can be extended. A combination of machine language and BASIC language software 
collects packets, selectively between stations if desired, and displays system code and 
data (in hexadecimal and character format). You may add more complex selection 
criteria, and more sophisticated packet formatting routines. 


2. Performance Measurement Software 


The network monitoring program COUNT is provided, which displays network activity 
in real time. It will locate all stations powered up on the network and display a real- 
time count of packets transmitted from each. Reconfigurations are counted as they 
occur for problem detection. Real-time "analog" meter displays show network traffic 
load and token transit time. A "skyline" graph displays the recent history of network 
traffic. 


3. Development System Software 
The system can function as a development environment for your own custom line 
analysis software. Included with the system are: MICROSOFT MASM 4.0 machine 


language assembler, Microsoft QuickBASIC compiler 2.0, LINK program and a machine 
language DEBUG package. 


4, CONFIGURATION AND ORDERING INFORMATION 


Part number: R-4903 ARCNET Line Analyzer 
For installation by end-user in existing IBM PC equipment 


Price (USA): $7,200.00 per unit, F.O.B. Sunnyvale, CA. 
OEM quantity terms available (25 or more units) 


Delivery: 60 days A.R.O. 


5. INSTALLATION 


The Sniffer system (R-4903) consists of the following components: 


1. A network interface card, configured to be station number $77, where $ indicates a 
hexadecimal number. If you need to change the Sniffer station address, see the in- 
structions and warning below. The Sniffer cannot be assigned ARCNET station 
addresses $00, $01, $02, $03, or $80. 


2. The Software: Diskettes with the Assembler, the Basic Compiler, and two diskettes 
with the Sniffer software. One diskette ("OBJECT") is executable, and can be used to 
test and run the system rapidly. The other ("SOURCES") contains the full source code 
for the SNIFFER and COUNT programs; see section 8 for information on modifying 
and rebuilding the programs. 


Open your IBM PC computer and install the network interface card in any free slot. 


If you wish to change the ARCNET station address of the Sniffer because the default 
address of $77 is in use on your network, then set the ARCNET station address to 
whatever you choose, except ARCNET station addresses $00, $01, $02, $03, or $80. 
Doing so will produce meaningless results and may adversely affect network be- 
havior. 


The station address is set by an 8-position switch marked "STN". The bit positions are 
indicated on the card by "Isb" for least significant bit, and "msb" for most significant 
bit; if the card is held with the connector up then the bits can be read in natural 
order with the most significant bit on your left. 


For each bit position, set the switch to OFF for a 1-bit and ON for a O-bit. 


To check the installation, power up your computer and boot into PC DOS. Next, 
replace the DOS diskette with the OBJECT diskette in drive A:. 


Connect the BNC connector on the rear panel to an operational ARCNET, watching the 
green light on the rear panel. The light should pulse (showing that reconfigurations are 
occuring) until you connect to the ARCNET, and become steady when connected. 


If all is well, enter COUNT at the A> prompt. You should see a display monitor of 
activity on your network at this time. See section 6 for an overview of COUNT and 
its operation. 


6. OPERATION 
The COUNT Program 


The COUNT program provides a realtime display of network activity for the entire 
ARCNET network. To run it, simply execute COUNT from the bootable OBJECT 
diskette by typing the program name. See section 7 for examples of the screens 

produced by COUNT. 


A. The Skyline Screen 


The first screen visible after starting COUNT is the "skyline" display of packet activ- 
ity, in which current network activity in packets per second is indicated by the height 
of the bar at the right of the screen. The bars shift left each second, so the entire 
screen shows the history of network activity during the last minute. 


Pressing the T ("Token") key suspends the skyline graph and shows a realtime slide 
indicator of the round-trip token transit time through the network. This will vary with 
the number of stations (roughly 30 microseconds per station), the length of cables, and 
the number and size of packets being transmitted. 


Pressing the S ("Skyline") key suspends the token time slide indicator and resumes the 
skyline display. 


Pressing the Q ("Quit") key terminates the COUNT program. 


Pressing the M ("Matrix") key switches to the network activity matrix display. 


B. The Matrix Display 


The center of this display is a matrix of 16 by 16 positions representing all 256 possi- 
ble ARCNET station addresses. A "*" indicates that a powered-up station was located. 
The first (hex) digit of its address is on the left hand axis, and the second across the 
horizontal axis. Counts indicating the number of packets sent by that station address 
will accumulate on the screen at each position. The Sniffer station’s position is marked 
by a happy-face symbol. 


The total number of stations is displayed at the bottom of the sceen along with real- 
time counters of packets sent and network reconfigurations which occured since the pro- 
gram was started. Below that is a slide indicator which shows the total network 
activity in packets per second. The motion of this indicator is smoothed and averaged 
over the last several seconds. 


Pressing the L ("Locate") key causes the program to rescan for active stations. A 
"4" will be displayed for stations which have appeared since the last scan, and a 
for ones which disappeared. 


The Z ("Zero") key will reset the counts and rescan the network. 


The M ("Meter") key will change the scale of the activity slide indicator from linear to 
logarithmic and back. 


The S ("Skyline") key will return to the Skyline display. 
The T ("Token") key will return to the token transit display of the Skyline screen. 


The Q ("Quit") command terminates the program. 


The SNIFFER Program 


The SNIFFER program is invoked from the bootable OBJECT diskette by typing the 
program name SNIFFER. A title banner will be displayed, along with the number of 
packets that can be held in the buffer memory, the Sniffer’s ARCNET station address, 
and the interrupt level being used. See the sample screens in the next section for 
examples. 


The Sniffer will use all available memory for packet buffers. To provide more buffers, 
add additional memory to the personal computer and configure the computer’s mother- 
board switches so that the extra memory is recognized. The Sniffer will then auto- 
matically use that extra memory for packet buffers. 


You are first asked how many packets should be recorded before processing is stopped. 
This may be more or less than the number of packets that can be buffered; if more, 
then the most recent packets that fit(it \the buffer will be retained. If you wish to 
process packets until stopped from keyboard, enter just a RETURN. (If you have 
restarted the Sniffer by mistake and wish to return to display the previously collected 
packets, enter -1.) 


You may now specify, in hexadecimal, the ARCNET addresses of the stations whose 
packets you which to record. Packets either sent or received from a designated station 
will be recorded, including packets which were sent but rejected by the receiving station 
because it found the checksum unacceptable. Either or both of the stations may be 
unspecified (by entering just RETURN). If both stations are unspecified, then all pack- 
ets on the network are recorded regardless of source and destination addresses. (See 
the discussion of the Options screen for information about 3-station filtering.) 


You are now asked to specify whether packet collection should be restricted to only 
certain packet types. This applies only if packets are recognized to be using the XNS 
(Xerox Network Systems) Sequenced Packet Protocol. If you wish no packet type 
restriction, enter RETURN. 


If you wish to restrict collection to particular XNS packet types, enter either a type 
number in decimal, or I for Nestar IOB types, or C for Nestar Command types. You 
will continue to be asked for additional types until you enter just RETURN. Note that 
this filtering applies to packets to be collected and thus will conserve packet buffer 
space. Additional filtering can be applied later to the display of collected packets. 


The Sniffer will now summarize your choices and start to process packets, recording 
those that satisfy the station address and packet type filters. Each packet recorded in 
the buffer causes the speaker to click. If you wish to see how many packets are cur- 
rently in the buffer, press the "p" key. Pressing any other key will terminate packet 
processing, as will reaching the specified limit of recorded packets. 


Under most real conditions, the Sniffer will not miss any transmitted packets. Under 
some extreme conditions of rapid trasmission of packets of much different sizes on 
small networks, some packets may be lost. In addition, using the "p" key increases 
the probability of losing a packet at that instant because of the processing time taken 


to display the count. The Sniffer will indicate in the display if it believes it possible 
that a packet has been lost. 


After packet processing has been terminated, you are presented with a one-line menu of 
commands that control the display of buffered packets. To choose a menu item, press 
the first letter of the command. 


Some of the commands will ask for a starting and ending packet number. You may 
enter any number between 1 and the maximum packet number, or the letter "Ff" or 
RETURN for the first packet and "I" or RETURN for the last packet. 


m llows; 


All: This causes a summary display of all packets in a specified range. If the pack- 
ets are recognized as Nestar/XNS packets, then information will be interpreted and dis- 
played according to the appropriate client-server transaction represented, otherwise the 
display will be in hex. Also displayed is the arrival time of each packet according to 
a countdown clock, and the time since the previous packet arrival, both in fractional 
seconds with an accuracy to one millisecond. 


Nestar/XNS packet display is done in either "data" mode, where the contents of the 
client/server message is interpreted, or in "header" mode, where the transport-level 
header is interpreted. The initial mode is "data", and the mode may be changed by 
using the Head or Data commands (q.v.). The various packets of a single transaction 
will be separated from other non-interleaved transactions by a blank line. 


If a reconfiguration occured in the vicinity of a packet, the station addresses will be 
separated by ">>" instead of the usual ">". In the rare situation that the sniffer 
believes one or more packets to have been lost, it will display "--Possible lost 
packet(s)". 


Cmds: This causes a summary display of only Nestar client-server command transac- 
tions for packets in a specified range. 


Iobs: This causes a summary display of only Nestar client-server I/O transfer transac- 
tions for packets in a specified range. 


Data: This will display the data portion of a single packet. If it is a Nestar/XNS 
transport-level packet the level 3 and 4 headers will be skipped, unless the Option 
screen (q.v.) has been used to request otherwise. Data mode will be set for subsequent 
All commands. SS 


Head: This will produce a formatted display of the Nestar/XNS level 3 and 4 headers 
for a single packet. Header mode will be set for subsequent All commands. 


Next: This displays the next frame in the same mode being used for the current 
frame. The arrival time difference between the two frames will also be displayed. 


Prev: This display the previous frame in the same mode being used for the current 
frame. The arrival time difference between the two frames will also be displayed. 


Frame: This can be used to go directly to a particular frame number. you will be 
prompted for the number, or "f" for the first frame, or "! for the last frame. 


Options: This causes a series of questions to be asked that sets various options of 
the Sniffer. See the description below and the sample screen. 


Restart: This is the command used to restart packet recording. You will again be 
asked for the station address and type filtering information. 


Quit: This will terminate the SNIFFER program and exit to the operating system. 
You will be asked to confirm your intention, since the stored packets will be lost when 
the program terminates. 


The Option Screen: 
Three options are currently controlled by questions asked from the Option screen: 
1. Should broadcast packets be collected? The default is: yes. 


2. Should the XNS header be printed as part of the data of a packet? The default is: 
no. 


3. Should 3-station filtering be allowed? The default is: no. 


If 3-station filtering is selected, you will be asked for a third ARCNET station address 
when packet recording is restarted. Packets sent from any of the three stations to any 
other of the three will be recorded. 


For each option, the current setting is described and you are asked whether to change 
it. Respond with "y" or "n" followed by RETURN. You can always exit from the 


Option screen without making any changes by entering three consecutive “n’ responses. 


7. SAMPLE SCREENS 
COUNT program Skyline Display 


COUNT -- Network Performance Monitor Version 5.0 
Copyright 1986 Network General Corporation 
SKYLINE GRAPH OF PACKETS TRANSMITTED EVERY SECOND 
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SECONDS AGO: 60 50 40 30 20 10 0 


TOKEN TRANSIT TIME IN MILLISECONDS 
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Press: (M)atrix (S)kyline (T)oken (Q)uit 


COUNT program Matrix Display 


COUNT -- Network Performance Monitor Version 5.0 
Copyright 1986 Network General Corporation 

0 1 2 3 4 5 6 7 8 9 a b c d e f 
0 » * . . ‘ ‘. * *0 5 ; : ; ‘ ; ; ° 
1 7 * 157 ‘ ‘ . : on ‘ ‘ ‘ : ; : . * 
2 * 136 . . : * * 2 * . ‘ 32 . * * * 
3 ‘ ; . * 1488 ® 4 3 * ‘ . ‘ * ‘ m 
4 * 290 * . * ‘ ~4 < * ‘ ‘ * ‘ . ‘ 
5 A * . . 20 ‘ *5 : 29 ‘ * 335. 623 ‘ ° 
6 60 - 267 . . : : 6 ° ° . . ° 32 ‘. ‘ 
7 ‘ 2 * 14 * ‘ * *7 ‘ * . * : * * 150 
8 23 14 * ‘ . . * 8 * 7 673 259 ‘ i ‘ . 
9 - 1687 * 1464 ; 52 ‘ *9 * “ . i ‘ * 18 * 
a ‘ * . ‘ * * ‘ a 4 : ° . * . . ° 
b i : . * * ‘ : »D ‘ ‘ ‘ : ‘ ‘ ‘ ‘ 
c ° - 405 * ° . ° ct * ° ° ° . ° . ° 
d 197 * ‘ 39 62 797 ‘ -d “ 3 ‘ ; ‘ ° ‘- ‘ 
e 8 8 8 : - 105 . -e : ; 69 * ‘ * : : 
f . - 2963 * 74 - 1240 ef 613 2370 ‘ . ‘ - 4823 . 

0 1 2 3 4 5 6 7 8 9 a b c d e f 
92 online stations 25760 packets and 0 recons since 14:16 on 3/14 

Packets per second 

ee 
O------------ 200------------ 400------------ 600------------ 800------------- 1000 


Press: L(ocate) M(eter lin -> log) z(ero) S(kyline) T(oken) Q(uit) 


(Note that some fields on the screen are in reverse video for better visibility, which 
cannot be shown here.) 


SNIFFER Startup Screen 


A>sniffer 


KKKKKEEKEKEKREREKREKKEKEEKEREREEKREERERKEREERERKEREKKEEEKE 


+ 
+ 


* ARCNET Sniffer Version 6.0 
* 
* Copyright 1986 Network General Corporation 


+r + + 


KARAKRAEKKEKKEKREKRREKREEEREREKRKEREREKREREREREKEKEKEKKKEKRERERE 


The buffer can hold 513 packets. 
The sniffer’s address is $42; Interrupt level is 2 


Please enter the number of packets after which to stop 
(RETURN will continue until stopped manually) 
(-1 will return to the display menu) 
? 
Enter stations you are interested in (in hex), or RETURN for don’t-care 
STATION 1 :? 36 
STATION 2 :? 
Enter type filters, which are accumulated until you enter RETURN 
Enter type number in decimal, I(0Bs), C(mds), or RETURN: 
? 


Screen while collecting packets 


63 of 513 packets recorded when ’p’ was last pressed 


Accepting packets between 36 and XxX. 
Broadcast messages will be accepted. 
Types being collected: All 


Will receive packets until interrupted. 


Press ’p’ to see how many packets have been recorded. 
Press any other key to stop packet collection. 


(F) Frame display screen (header mode) 


FRAME NUMBER 1 TIMESTAMP = 47.032 sec. 


SOURCE ID. = $36 DESTINATION ID. = $FE LENGTH = $58 
SYSTEM CODE = $FE GARBAGE COUNT = $00 


wn nee eee ee nee ee eee eee ** LEVEL 3 HEADERS **------------------ rrr rrr cce 


PACKET ID. = $00 FRAME NUMBER = $40 CHECKSUM = $FFFF 
LENGTH = 84 TRANSPORT CONTROL = 0 PACKET TYPE = 5 
>> SOURCE << >> DESTINATION << 
NETWORK: - $00000000 $00000000 
HOST: - $08000AB73F36 SO8000A0000FE 
SOCKET: - 34831 1032 


CONNECTION CONTROL :- ACK EOM DATA STREAM TYPE = $10 
SOURCE CONNECTION ID. = $0810 DESTINATION CONNECTION ID. = $0000 
SEQUENCE No. = 0 ACKNOWLEDGE No. = 0 ALLOCATION No. = 768 


v6.0: All,Cmds,Iobs, Data,Headers, Next,Prev,Frame, Options, Restart, Quit ? 


(F) Frame display screen (data mode) 


DATA ASSOCIATED WITH RECEIVED FRAME NUMBER 1 


00: 00 01 00 04 00 00 00 00 00 FF 00 00 00 00 1B 53 *......-.- ss vecee S* 
10: 48 4F 57 20 50 52 4F 54 45 43 54 20 2F 2F 55 53 *HOW PROTECT //US* 
20: 45 52 53 2F 4C 4A 53 2F 31 OD *ERS/LJS/1.* 


v6.0: All,Cmds,Iobs, Data,Headers, Next,Prev,Frame, Options, Restart, Quit ? 


(A) All packet summary display screen (data mode) 


starting frame (RETURN for first)? 
ending frame (RETURN for last)? 
Enter stations you are interested in (in hex), or RETURN to continue 


STATION 1 :? 
STATION 2 :? 
Enter list device (RETURN for screen, 


’prn’ for printer) ? 


press the space bar to abort listing 


47.032 18.504 
46.793 0.239 
46.787 0.006 
46.776 0.011 
46.750 0.026 
46.741 0.009 
46.722 0.019 
46.711 0.011 
46.691 0.020 
46.680 0.011 
38.095 8.585 
38.032 0.063 
38.030 0.002 
38.024 0.006 
38.005 0.019 
37.953 0.052 
37.951 0.002 
37.947 0.004 
37.926 0.021 
37.872 0.054 
37.871 0.001 
37.867 0.004 
37.846 0.021 
37.796 0.050 


36 
FE 
36 
FE 
36 
FE 
36 
FE 
36 
FE 


36 
FE 
FE 
36 


36 
FE 
FE 
36 


VVVVv VVVVVV VV VV 


VVV WV 


VVVV 


FE 
36 
FE 
36 
FE 
36 
FE 
36 
FE 
36 


FE 
36 
36 
FE 


FE 
36 
36 
FE 


FE 
36 
36 
FE 


FE 
36 


SHOW PROTECT //USERS/LJS/1<0D> 

/MAIN/USERS/LJS/1 

<rfnm - type: 0 
PUBACC=R 

<rfinm - type: 0 
GRPACC= 

<rfnm - type: 0 
PRVACC=RWECD, 

<rfinm - type: 0 

0,OK 


sub: 0 size:SFF offset:$0> 


sub: 0 size:SFF offset:$0> 


sub: 0 size:SFF offset:$0> 
PW 


sub: 0 size:SFF offset:$0> 


<etna iob - read drive:5 size:$0200 offset:$0E00> 
<type 8 data> T I M E T ES TPA... 
<type 8 data> 00 00 00 00 00 00 00 00 DD 98 ... 
<result iob, statusl:ok, status2:0 > 


<etna iob - read drive:5 size:$0200 offset:$1000> 
<type 8 data> L A N D & C A P 
<type 8 data> 00 00 00 00 00 00 00 00 I 
<result iob, statusl:ok, status2:0 > 


8B ...- 


<etna iob - read drive:5 size:$0200 offset:$1200> 
<type 8 data> C O N F I G E D 
<type 8 data> 00 00 00 00 00 00 00 OO F a 
<result iob, statusl:ok, status2:0 > 


<etna iob - read drive:5 size:$0200 offset:$1400> 
<type 8 data> P H P R O P 


v6.0: All,Cmds,Iobs, Data,Headers, Next,Prev,Frame, Options, Restart, Quit ? 


(A) All packet summary display screen (header mode) 


starting frame (RETURN for first)? 
ending frame (RETURN for last)? 


Enter stations you are interested in (in hex), 


STATION 1 :? 
STATION 2 
Enter list device (RETURN for screen, 


33 


press the space bar to abort listing 


+ 


Se 
NEF OWUDUNANAUAWNeH 


# 
13 


v6.0: All,Cmds,Iobs, Data,Headers, Next,Prev,Frame, 


time 
47.032 
47.024 
46.793 
46.787 
46.776 
46.750 
46.741 
46.722 
46.711 
46.691 
46.680 
46.656 


time 
38.095 


delta 
18.504 
0.008 
0.231 
0.006 
0.011 
0.026 
0.009 
0.019 
0.011 
0.020 
0.011 
0.024 


delta 
8.561 


s 

r 

Cc 

36 
FE 
FE 
36 
FE 
36 
FE 
36 
FE 
36 
FE 
36 


Ss 
r 
Cc 
36 


VVVVVVVVV VV VV 


> 


dq 

s 

t len 
FE 84 
36 42 
36 60 
FE 52 
36 653 
FE 52 
36 52 
FE 52 
36 61 
FE 52 
36 47 
FE 42 


dq 
Ss 
t len 
FE 77 


t 


dsck 
0408 
880F 
880F 
OBBY 
880F 
OBBY 
880F 
OBB9 
880F 
OBB9 
880F 
OBB9 


ssck 
880F 
OBB9 
OBB9 
880F 
OBB9 
880F 
OBBY 
880F 
OBB9 
880F 
OBBY 
880F 


ssck dsck 
8810 0408 


RFODODDDOCOOCOOrFONK Nn 
OPP RP RPEPPEFPFEFROFZXO ® 
ooooCoCCCCCCOCOF cD 
ORR RPEPEPRPEPFRPRFROFS O 
oO 
ret 


Ss 
Y 
Ss 
0 


’prn’ for 


KAO 


or RETURN to continue 


printer) ? 


sid did 
0810 0000 
45B6 0810 
45B6 0810 
0810 4566 
45B6 0810 
0810 45B6 
45B6 0810 
0810 45B6 
45B6 0810 
0810 45B6 
45B6 0810 
0810 45B6 


sid did 
OF 0811 0000 


oduct 
ma OM 


seq 
0000 
0000 
0000 
0001 
0001 
0002 
0002 
0003 
0003 
0004 
0004 
0005 


seg 
0000 


Options, Restart, 


ack 

0000 
0001 
0001 
0001 
0002 
0002 
0003 
0003 
0004 
0004 
0005 
0005 


ack 
0000 


Quit 


(C) Command packets only summary display screen (data 


starting frame (RETURN for first)? 
ending frame (RETURN for last)? 
Enter stations you are interested in (in hex), or RETURN to continue 


STATION 1 
STATION 2 :? 


“7 


Enter list device (RETURN for screen, ’prn’ for printer) ? 
press the space bar to abort listing 


3 


= 
9 
ll 


47.032 
46.793 
46.776 
46.741 
46.711 
46.680 


18.504 
0.239 
0.017 
0.035 
0.030 
0.031 


> 
> 
> 
> 
> 
> 


FE SHOW PROTECT //USERS/LJS/1<0D> 
36 /MAIN/USERS/LJS/1 

36  PUBACC=R 

36 GRPACC= 

36 PRVACC=RWECD, PW 

36 0,OK 


mode) 


v6.0: All,Cmds,Iobs, Data,Headers, Next,Prev,Frame, Options, Restart, Quit ? 


(I) he transaction packets only summary display screen (data 
mode) 


starting frame (RETURN for first)? 
ending frame (RETURN for last)? 
Enter stations you are interested in (in hex), or RETURN to continue 


STATION 1 
STATION 2 
Enter list device (RETURN for screen, 


2? 


$? 


press the space bar to abort listing 


13 
17 


19 
23 


25 
29 


31 
35 


37 
41 


43 
47 


49 
53 


oo 


38.095 
38.024 


38.005 
37.947 


37.926 
37.867 


37.846 
37.790 


37.772 
37.729 


37.709 
37.646 


37.626 
37.572 


37.465 


27.441 
0.071 


0.019 
0.058 


0.021 
0.059 


0.021 
0.056 


0.018 
0.043 


0.020 
0.063 


0.020 
0.054 


0.107 


36 
36 


36 
36 


36 
36 


36 
36 


36 
36 


36 
36 


36 
36 


36 


> 
? 


> 


FE 
FE 


FE 
FE 


FE 
FE 


FE 
FE 


FE 
FE 


FE 
FE 


FE 
FE 


FE 


<etna iob - read drive:5 
<result iob, statusl:ok, 


<etna iob - read drive:5 
<result iob, statusl:ok, 


<etna iob - read drive:5 
<result iob, statusl:ok, 


<etna iob - read drive:5 
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<etna iob - read drive:5 


v6.0: All,Cmds,Iobs, Data,Headers, Next,Prev,Frame, 


’prn’ for printer) ? 


size:$0200 offset:$0E00> 
status2:0 > 


size:$0200 offset:$1000> 
status2:0 > 


size:$0200 offset:$1200> 
status2:0 > 


size:$0200 offset:$1400> 
status2:0 > 


size:$0200 offset:$1600> 
status2:0 > 


size:$0200 offset:$1800> 
status2:0 > 


size:$0200 offset:$1A00> 
status2:0 > 


size:$0200 offset:$0E00> 


Options, Restart, Quit ? 


8. CUSTOM SOFTWARE MODIFICATION 


Complete source files for the COUNT program and the SNIFFER program are provided 
on the SOURCES diskette so that modifications may be made to satisfy individual 
requirements. 


WARNING: ‘ihe software on this diskette is licensed for your modification and 
subsequent use ONLY with the R-4903 ARCNET Line Analyzer it accompanies. 
Use for any other purpose, or dissemination to third parties, is prohibited. 


The files on the distributed SOURCES disk are in two subdirectories as follows: 


Volume in &rive A is SOURCES 
Directory of A:\SNIFFER 


‘ <DIR> 9-25-86 10:52a 
— <DIR> 9-25-86 10:52a 
BLDSNIFF BAT 324 9-25-86 12:00p 
SNASM ASM 32006 9-25-86 12:00p 
SNIFFER BAS 34329 9-25-86 12:00p 
STRUCT MAC 4691 9-25-86 12:00p 
6 File(s) 65536 bytes free 


Volume in drive A is SOURCES 


Directory of A:\COUNT 


. <DIR> 9-25-86 10:52a 
as <DIR> 9-25-86 10:52a 
BLDCOUNT BAT 425 9-25-86 12:00p 
COUNT C 16467 9-25-86 12:06p 
L4ASM ITF 9477 9-25-86 12:00p 
NPML4 ASM 7090 9-25-86 12:00p 
NPMLIN TAB 39894 9-25-86 12:00p 
NPMLOG TAB 39896 9-25-86 12:00p 
NPMMTRIX ASM 34108 9-25-86 12:00p 
NPMSKY TAB 39894 9-25-86 12:00p 
NPMSKYTT ASM 30368 9-25-86 12:00p 
11 File(s) 65536 bytes free 


The batch files BLDSNIFF and BLDCOUNT show how to assemble, compile, and link 
the SNIFFER and the COUNT program, respectively. ip ee 


The SNIFFER program is in BASIC and Assembler language, and can be rebuilt using 
the compiler, assembler, and linker provided with the Sriffer. The COUNT pregram is 
in C and Assembler ianguage, and requires a C compiler {not supplied) compatible with 
Microsoft Version 4.0. \ eds 


To recreate the SNIFE'ER and COUNT programs, copy the sources to similarly named 
subdirectories of a hard disk. The batch file in each subdirectory can be used to 
rebuild the programs, subject to the assumption that the compiler is found in the path 
C:\TOOLS. You may need to change the batch files in minor ways 49 suit, the partic- 
ular development environment. 


Information about the internals of the programs can be found in in the source listings. 


9. SNIFFER PROGRAMMING 


The SNIFFER Program software consists of two parts: a set of assembly language 
subroutines for accessing the Sniffer hardware, and a BASIC language driver program 
which contains the operator interface and the packet formatting routines. 


Only the BASIC program has knowledge of screen formatting and Nestar XNS packet 
formats. If you wish to change the screens, or add additional packet type decoding, 
you should be able to do so by modifying only the BASIC program. You should, how- 
ever, read the comments in the assembly language code to learn how those routines 
are called. 


If you wish to make modifications to the assembly language routines, or write your 
own versions, you will need to be familiar with programming the Network Interface 
Card as described in the accompanying Nestar manual LC40-0404 "CARDCHK Utility 
program and Network Interface Card Theory of Operation for the IBM Personal 
Computer", as well as the documents referenced there which explain the programming 
of the LSI devices that implement ARCNET. Additional features of the Sniffer NIC 
are as follows: 


NIC Control and Status Register (xx0802) 


Bit DO: Controls the operation as a Sniffer. When written with 0, the Sniffer 
is a normal NIC; when written with 1, Sniffer operation is enabled and 
packets from all stations will be received. 


As a status input, DO indicates that a packet has been received by the 
Sniffer, and a Sniffer interrupt has been requested. 


Bit D2: Enables Sniffer interrupts when written with 1; disables Sniffer interru °' 
pts when written with 0. Nive” : | 


Other notes about the Sniffer hardware: 


1. A normal “enable receive" command shouldbe sent to the RIM before the 
Sniffer is enabled. 
Jif Sa Su 
2;°"When a-packet has2been received, the Sniffer should be momentarily disabled 
“'Ujpy writing a 0 intorbit DO of the control register, then later reenabled for 
the next packet. This should be done as quickly as possible to avoid 
missing the next packet. Before reenabling the Sniffer, you can reissue the 
RIM “enable: receive" to change to a different buffer if the data from the 
previous packet has not been processed. . . | 


3. As fay as the RIM is concerned, packets received, by the Sniffer are not 
valid and will not result in setting the RI status bit. The only exception is 
that broadcast packets on the network will be received in the usual fashion. 


If RI ever gets set while the Sniffer is in operation, the "enable receive" 
command to the RIM will have to be reissued. 


As with any other interrupting device, the interrupt controller of the PC 
(8259) must be enabled to receive interrupts from the interrupt level to 
which the NIC is wired, which is IRQ 2 by default. The interrupt controller 
must also be cleared before the interrupt routine ends to arm it for the next 
interrupt. 


